d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

MFC 290028:

Browse Source 
Turning on IPSEC used to introduce a slight amount of performance
degradation (7%) for host host TCP connections over 10Gbps links,
even when there were no secuirty policies in place. There is no
change in performance on 1Gbps network links. Testing GENERIC vs.
GENERIC-NOIPSEC vs. GENERIC with this change shows that the new
code removes any overhead introduced by having IPSEC always in the
kernel.

Differential Revision:	D3993
Sponsored by:	Rubicon Communications (Netgate)
This commit is contained in:
gnn 2015-11-26 02:24:45 +00:00
parent e417a2afca
commit 3b2535b452
3 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet/ip_ipsec.c
View File

@ -230,6 +230,10 @@ ip_ipsec_output(struct mbuf **m, struct inpcb *inp, int *flags, int *error)
struct secpolicy *sp = NULL;
struct tdb_ident *tdbi;
struct m_tag *mtag;
if (!key_havesp(IPSEC_DIR_OUTBOUND))
return 0;
/*
* Check the security policy (SP) for the packet and, if
* required, do IPsec-related processing. There are two

3
sys/netinet/tcp_subr.c
View File

@ -1947,7 +1947,8 @@ ipsec_hdrsiz_tcp(struct tcpcb *tp)
#endif
struct tcphdr *th;
if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL))
if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) ||
(!key_havesp(IPSEC_DIR_OUTBOUND)))
return (0);
m = m_gethdr(M_NOWAIT, MT_DATA);
if (!m)

6
sys/netipsec/ipsec.c
View File

@ -1273,6 +1273,9 @@ ipsec46_in_reject(struct mbuf *m, struct inpcb *inp)
int error;
int result;
if (!key_havesp(IPSEC_DIR_INBOUND))
return 0;
IPSEC_ASSERT(m != NULL, ("null mbuf"));
/*
@ -1405,6 +1408,9 @@ ipsec_hdrsiz(struct mbuf *m, u_int dir, struct inpcb *inp)
int error;
size_t size;
if (!key_havesp(dir))
return 0;
IPSEC_ASSERT(m != NULL, ("null mbuf"));
/* Get SP for this packet.